{"ip":"172.174.115.124","total_events":12,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"308 bytes sent","bytes_sent":308,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-20T06:43:58","last_seen":"2026-10-05T03:53:33","events_24h":1,"events_7d":4,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":8443,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T16:34:03","last_seen":"2026-10-05T16:34:03","recent":[{"timestamp":"2026-10-05T16:34:03","port":8443,"src_port":58290,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_8443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383434330a","sni":"","session":"fd3d8fee-5f6d-4be8-8e57-feb911c9bafc","bytes_in":26,"source_verified":false,"enriched":{"digest":"6f7f3440a9023eca","strings":["MGLNDD_<HONEYPOT>_8443"]}}]},"top_ports":[{"port":123,"proto":"tcp","label":"NTP","count":2},{"port":8333,"proto":"tcp","label":"Bitcoin","count":2},{"port":9990,"proto":"tcp","label":"","count":1},{"port":554,"proto":"tcp","label":"","count":1},{"port":1194,"proto":"tcp","label":"OpenVPN","count":1},{"port":5061,"proto":"tcp","label":"SIPS","count":1},{"port":8222,"proto":"tcp","label":"","count":1},{"port":6066,"proto":"tcp","label":"","count":1},{"port":9999,"proto":"tcp","label":"","count":1},{"port":5351,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-20","count":1},{"date":"2026-09-21","count":1},{"date":"2026-09-22","count":1},{"date":"2026-09-25","count":3},{"date":"2026-09-26","count":1},{"date":"2026-09-27","count":1},{"date":"2026-09-30","count":1},{"date":"2026-10-03","count":2},{"date":"2026-10-05","count":1}],"recent_events":[{"timestamp":"2026-10-05T03:53:33","port":5351,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5351\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353335310a","method":"","user_agent":"","ja3":"","session":"1eb29a6a-035f-4e92-babb-93749c7be9cd","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":15,"enriched":{"digest":"e158939d534ced87","strings":["MGLNDD_<HONEYPOT>_5351"]}},{"timestamp":"2026-10-03T07:50:54","port":6066,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_6066\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f363036360a","method":"","user_agent":"","ja3":"","session":"fd170d6e-a7c5-4e00-870c-c93322f521f7","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":15,"enriched":{"digest":"6a084a2d85c0db6a","strings":["MGLNDD_<HONEYPOT>_6066"]}},{"timestamp":"2026-10-03T07:20:47","port":1194,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1194\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313139340a","method":"","user_agent":"","ja3":"","session":"99803b0b-6420-4fc2-aba4-1cfd1826b193","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":15,"enriched":{"digest":"0b7bb21eee00c809","strings":["MGLNDD_<HONEYPOT>_1194"]}},{"timestamp":"2026-09-30T04:41:13","port":8333,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8333\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383333330a","method":"","user_agent":"","ja3":"","session":"63587a97-6774-4a6e-83e3-833d0b8a0770","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":15,"enriched":{"digest":"0c8f3d85c9b5f804","strings":["MGLNDD_<HONEYPOT>_8333"]}},{"timestamp":"2026-09-27T20:57:36","port":9999,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9999\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939390a","method":"","user_agent":"","ja3":"","session":"794f8bdc-d2bd-49ff-93bc-f89f0b1314f5","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":15,"enriched":{"digest":"d4bd826f7438193d","strings":["MGLNDD_<HONEYPOT>_9999"]}},{"timestamp":"2026-09-26T16:50:06","port":8333,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8333\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383333330a","method":"","user_agent":"","ja3":"","session":"eb413a15-cb2f-4e31-94d1-8e1aa2a2a2b2","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":15,"enriched":{"digest":"0c8f3d85c9b5f804","strings":["MGLNDD_<HONEYPOT>_8333"]}},{"timestamp":"2026-09-25T20:07:54","port":554,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_554\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3535340a","method":"","user_agent":"","ja3":"","session":"3e3ddab5-9dae-4eb5-acea-49442f5a50b0","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":15,"enriched":{"digest":"d2657505c1c187a5","strings":["MGLNDD_<HONEYPOT>_554"]}},{"timestamp":"2026-09-25T15:01:04","port":123,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_123\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3132330a","method":"","user_agent":"","ja3":"","session":"849d7470-0c90-4d3f-bba4-d98e1be8bf49","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":15,"enriched":{"digest":"b405ee720dc0ae95","strings":["MGLNDD_<HONEYPOT>_123"]}},{"timestamp":"2026-09-25T15:01:04","port":123,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_123\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3132330a","method":"","user_agent":"","ja3":"","session":"3d7b0656-7a99-44b0-a2a8-5e41142c0cb3","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":15,"enriched":{"digest":"b405ee720dc0ae95","strings":["MGLNDD_<HONEYPOT>_123"]}},{"timestamp":"2026-09-22T05:00:00","port":9990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9990\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939300a","method":"","user_agent":"","ja3":"","session":"9e55c7b7-248b-49d1-908b-19c1398797ad","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":15,"enriched":{"digest":"9d0f9a64e3b3ca3f","strings":["MGLNDD_<HONEYPOT>_9990"]}}],"http_methods":[],"distinct_ports_total":10,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T19:36:43.590292+00:00"}